An origin validation flaw in the Apex One/SEP agent allows a local attacker who already has low‑privileged code execution to elevate privileges. The flaw involves improper validation of data arriving over a named pipe, granting the attacker higher system rights. Because the attacker must first execute code locally, the impact is limited to systems where local code execution is possible, but it can compromise the entire host once privileges are escalated.

Trend Micro’s TrendAI Apex One and TrendAI Apex One as a Service are affected. The vulnerability exists in on‑prem Apex One version 14.0.0.17079 and in the SaaS version 14.0.0.20731. Both versions rely on a named pipe IPC mechanism that is vulnerable to origin validation bypass.

The CVSS score of 7.8 marks this flaw as high severity, and it is not currently listed in the CISA KEV catalog. EPSS data is not available, so the likelihood of exploitation is unknown, but the local requirement reduces the attack surface to users who can run code on the machine. An attacker who gains low‑privileged execution can exploit the origin validation bypass to raise privileges, making the vulnerability potentially critical in environments where local code execution is possible.